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EXAMINER'S ANSWER 



This is in response to the appeal brief filed August 1 1 , 2008, appealing from the Office 
action mailed December 10, 2007. 
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(1) Real Party in Interest 

A statement identifying by name the real party in interest is contained in the brief. 

(2) Related Appeals and Interferences 

The examiner is not aware of any related appeals, interferences, or judicial 
proceedings which will directly affect or be directly affected by or have a bearing on the 
Board's decision in the pending appeal. 

(3) Status of Claims 

The statement of the status of claims contained in the brief is correct. 

(4) Status of Amendments After Final 
No amendment after final has been filed. 

(5) Summary of Claimed Subject Matter 

The summary of claimed subject matter contained in the brief is correct. 

(6) Grounds of Rejection to be Reviewed on Appeal 

The appellant's statement of the grounds of rejection to be reviewed on appeal is 
correct. 

(7) Claims Appendix 

The copy of the appealed claims contained in the Appendix to the brief is correct. 

(8) Evidence Relied Upon 

20040205355 Boozer et al. 10-2004 

20040133583 Tingey 7-2004 

(9) Grounds of Rejection 

The following ground(s) of rejection are applicable to the appealed claims: 
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Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 1. 3-18, 20-34, and 36-39 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Boozer etal. (U.S. Patent Pub. 2004/0205355 A1) in view of Tinqev 
(U.S. Patent Pub. No. 2004/0133583). 



Regarding claims 1,18, and 34 , Boozer et al. teaches a 
method/system/computer storage medium for providing Resource-Event-Agent (REA) 
model based security, the method/system/computer storage medium comprising: 

• Identifying an REA defined association of a type which dictates ownership 
between a first object and a second object (page 1, paragraph 0016); 

• Creating an association class for the REA defined association between the first 
object and second object, the association class defining security between the first 
object and the second object (page 1 , paragraph 0018); and 

• Storing the association class object on a tangible computer readable medium for 
use in providing security between the first object and the second object 
(paragraph 0088). 
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Boozer et al. does not specifically teach REA models and wherein creating the 
association class object for the association between the first object and the second 
object further comprises creating an association class object having properties defining 
security between the first object and the second object. 

Tinqev teaches REA models (fig. 1), and wherein creating the association class 
object for the association between the first object and the second object further 
comprises creating an association class object having properties defining security 
between the first object and the second object (paragraph 0066). 

It would have been obvious to one of ordinary skill in the art, at the time the 
invention was made, to combine creating an association class object having properties, 
the properties of the association class object defining the security between the first 
object and the second object, as taught bv Tinqev . with the method/system/computer 
readable medium of Boozer et al. It would have been obvious for such modifications 
because objects have properties that define the attributes of the object. The attributes 
define the object and therefore define the security between the two objects. 

Regarding claims 3, 20, and 36 , the combination of Boozer et al. in view of 
Tinqev teaches wherein creating the association class object further comprises creating 
one or more association class objects having properties, properties of the one or more 
association class objects defining security between a first class of objects of which the 
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first object is a member and a second class of objects of which the second object is a 
member (see paragraph 0066 of Tingey). 

Regarding claim 4 , the combination of Boozer et al. in view of Tinqev teaches 
wherein the second object is a securable object (see page 1 , paragraph 0018 of Boozer 
et al., the objects may have security parents). 

Regarding claims 5 and 21 . the combination of Boozer et al. in view of Tinqev 
teaches wherein the first object is of a particular agent type, and wherein a role for a 
user is defined by the particular agent type for the first object (see page 6, paragraph 
0066 and 0076 of Boozer et al.). 

Regarding claims 6-10 and 22-26 , the combination of Boozer et al. in view of 
Tinqev teaches wherein the second object is a contract or agreement type object, a 
commitment type object, an event type object, a resource type object, and an agent 
type object (see fig. 1 of Tingey, REA model contains all of the mentioned object types). 

Regarding claims 11,12, 27. and 28 , the combination of Boozer et al. in view of 
Tinqev teaches wherein identifying the REA defined association of the type which 
dictates ownership between the first object and the second object further comprises 
identifying an REA defined [control type/custody type] association between the first 
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object and the second object (see page 1, paragraph 0016 and page 3, paragraph 0033 
of Boozer et al., control meaning 'ownership' and custody meaning 'template'). 

Regarding claims 13 and 29 , the combination of Boozer et al. in view of Tinqev 
teaches wherein creating the REA defined association class object for the association 
between the first object and the second object further comprises creating the 
association class object in a security model (see page 1, paragraph 0016 of Boozer et 
al.). 

Regarding claims 14, 30, and 37 , the combination of Boozer et al. in view of 
Tinqev teaches wherein creating the association class object in the security model 
further comprises creating the association class object in the security model separate 
from the REA model (see fig. 19, ref. num 1200 of Boozer et al.). 

Regarding claims 15, 31, and 38 , the combination of Boozer et al. in view of 
Tinqev teaches wherein creating the association class object in the security model 
further comprises creating the association class object in the security model as part of 
the REA model (see fig. 2 of Boozer et al.). 

Regarding claims 16, 32, and 39 , the combination of Boozer et al. in view of 
Tinqev teaches wherein defining security between the first object and the second object 
further comprises defining permissions and rights of the first object relative to the 
second object (see page 2/3, paragraph 0029 of Boozer et al.). 
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Regarding claims 17 and 33 , the combination of Boozer et al. in view of Tinqev 
teaches wherein defining permissions and rights of the first object relative to the second 
object further comprises dynamically determining the permissions and rights in a 
security policy logic module outside of the security model (see paragraph 0066 of 
Tingey). 

(10) Response to Argument 

Appellant argues: 

a. Boozer does not teach REA models, particularly "creating an association 
class object for the REA defined association between the first object and the 
second object, the association class object having properties defining security 
between the first object and the second object" (page 8, second and third 
paragraph). 

b. Tingey does not teach REA security, namely "creating an association 
class object for the REA defined association between the first object and the 
second object, the association class object having properties defining security 
between the first object and the second object" (page 9, second paragraph 
through page 10, first paragraph). 

c. The combination of references does not teach identifying an REA defined 
[control type/custody type] association between the first object and the second 
object (page 1 1 and page 12). 
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Regarding argument (a), examiner disagrees with appellant. Boozer shows 
associations between objects to determine security between the objects. In figure 2, the 
first object and second object are in a relationship with each other, as imposed by the 
containment boundary (see paragraph 0018 of Boozer). The containment boundary 
establishes security rules for the two objects, which is an association class object. 
Boozer is not purported to teach REA model, but rather Tingey discloses an REA 
model. The rejection of the pending claims above was done in combination, using 
material from two references to arrive at the claimed invention. Boozer uses a model 
with objects and associations, just not an REA model, while Tingey discloses an REA 
model with objects having properties. 

Regarding argument (b), examiner disagrees with appellant. Looking back at the 
rejection of claims 1,18, and 34, above, Boozer was cited as teaching "identifying an 
REA defined association of a type which dictates ownership between and first object 
and a second object" and "creating an association class for the REA defined association 
between the first object and the second object, the association class defining security 
between the first object and the second object." It was then said that Boozer didn't 
teach a specific model (REA) and also did not teach that the created association class 
comprised properties defining security between the first object and second object. 
Therefore, what is required of Tingey is to teach REA modeling which uses properties to 
define security between two objects. Figure 1 of Tingey clearly shows that REA 
modeling is used. Paragraph 0066 of Tingey discloses security in a model that uses 
classification and hierarchy. The hierarchy of Tingey uses attributes (figure 15, for 



Application/Control Number: 10/815,052 Page 9 

Art Unit: 2436 

example). Properties and attributes are synonymous terms; therefore, Tingey teaches 
"the association class object having attributes defining security between two objects." 

Regarding argument (c), examiner disagrees with appellant. Examiner related 
the term "ownership" with the claimed "control" and the term "template" with the claimed 
"custody." Page 20, lines 9-12, of appellant's specification, teaches that "ownership" is 
interpreted to be a control type association. Page 20, lines 21-27, of appellants' 
specification, teaches that "responsibility" is interpreted to be a custody type 
association. The specification goes on to say that the Agent will be granted some 
default permissions on the Resource. This is an example of a template as disclosed by 
Boozer. 

(11) Related Proceeding(s) Appendix 

No decision rendered by a court or the Board is identified by the examiner in the 
Related Appeals and Interferences section of this examiner's answer. 

For the above reasons, it is believed that the rejections should be sustained. 

Respectfully submitted, 

/Brandon S Hoffman/ 

Primary Examiner, Art Unit 2436 

Conferees: 

/Nasser G Moazzami/ 
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Supervisory Patent Examiner, Art Unit 2436 

/Kambiz Zand/ 

Supervisory Patent Examiner, Art Unit 2434 



